Gateway: harden cron.runs jobId path handling (openclaw#24038) thanks @Takhoffman

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: Takhoffman <781889+Takhoffman@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>

src/gateway/protocol/cron-validators.test.ts

@@ -46,4 +46,11 @@ describe("cron protocol validators", () => {
     expect(validateCronRunsParams({ id: "job-1", limit: 0 })).toBe(false);
     expect(validateCronRunsParams({ jobId: "job-2", limit: 0 })).toBe(false);
   });
+
+  it("rejects cron.runs path traversal ids", () => {
+    expect(validateCronRunsParams({ id: "../job-1" })).toBe(false);
+    expect(validateCronRunsParams({ id: "nested/job-1" })).toBe(false);
+    expect(validateCronRunsParams({ jobId: "..\\job-2" })).toBe(false);
+    expect(validateCronRunsParams({ jobId: "nested\\job-2" })).toBe(false);
+  });
 });

src/gateway/protocol/schema/cron.ts

@@ -59,6 +59,31 @@ function cronIdOrJobIdParams(extraFields: Record<string, TSchema>) {
   ]);
 }
 
+const CronRunLogJobIdSchema = Type.String({
+  minLength: 1,
+  // Prevent path traversal via separators in cron.runs id/jobId.
+  pattern: "^[^/\\\\]+$",
+});
+
+function cronRunsIdOrJobIdParams(extraFields: Record<string, TSchema>) {
+  return Type.Union([
+    Type.Object(
+      {
+        id: CronRunLogJobIdSchema,
+        ...extraFields,
+      },
+      { additionalProperties: false },
+    ),
+    Type.Object(
+      {
+        jobId: CronRunLogJobIdSchema,
+        ...extraFields,
+      },
+      { additionalProperties: false },
+    ),
+  ]);
+}
+
 export const CronScheduleSchema = Type.Union([
   Type.Object(
     {
@@ -241,7 +266,7 @@ export const CronRunParamsSchema = cronIdOrJobIdParams({
   mode: Type.Optional(Type.Union([Type.Literal("due"), Type.Literal("force")])),
 });
 
-export const CronRunsParamsSchema = cronIdOrJobIdParams({
+export const CronRunsParamsSchema = cronRunsIdOrJobIdParams({
   limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 5000 })),
 });